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REMARKS 

1. The Examiner's Answer quotes MPEP § 715.02, which states, in part: "The 37 
CFR 1.131 affidavit or declaration must establish possession of either the whole invention 
claimed or something falling within the claim" (emphasis in Examiner's Answer). The 
Examiner's Answer then incorrectly contends, "As such, in order to show possession of the 
claimed invention it is necessary to correlate the exhibits to the claimed limitations to facilitate 
evidence finding. The examiners cannot be expected to search the entire record for the 
evidence, the difference lies in the way in which the evidence is presented (MPEP 715.05)" 
(emphasis in Examiner's Answer). 

It is respectfully noted that MPEP § 715.02 states that it is the 37 CFR § 1.131 
declaration that must establish possession. Nothing is said about the exhibits establishing 
possession. Furthermore, the contention that correlating the exhibits with the claim limitations 
is inconsistent with 37 CFR § 1.131(b) which allows for exhibits to not accompany a 
declaration. If there are instances where exhibits are not required to accompany a declaration, 
then there cannot be a requirement to correlate exhibits to specific claim limitations. 

To clarify, the statement that the "examiners cannot be expected to search the entire 
record for the evidence" is specifically directed to interference testimony , not exhibits. Also, it 
is not clear what is meant and intended by the statement, "The difference lies in the way in 
which the evidence is presented." However, it is respectfully noted that this statement is 
immediately preceded by the statement, "The facts to be established under 37 CFR 1.131 are 
similar to those to be proved in interference" (MPEP § 715.07(111)). Thus, the MPEP is merely 
suggesting that the facts that there are similarities and differences between 37 CFR 1.131 
situations and interference situations. A similarity includes the facts that are to be established. 
A difference includes the way in which evidence is presented. 
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2. It is respectfully noted that the Examiner's Answer fails to address Appellants' 
argument that refers to the court ruling that " the PTO is required to accept Rule 131 Affidavits 
at face value , and without investigation " (see, e.g., Herman v. Williams Brooks Shoe Co., 39 
USPQ2d 1773, 1777 (S.D. N.Y. 1996); see also Chisum on Patents § 3.08[l][a] (2005); 
emphasis added). This court ruling does not mean that an examiner should not look at the 
exhibits. However, the court ruling does suggest that if the exhibits appear to be what the 
inventors purport in the declaration, then the examiner need not make a further inquiry with 
respect to the exhibits. 

3. Page 16 of the Examiner's Answer emphasizes the following statement from 
MPEP § 715.07, "Applicant must give a clear explanation of the exhibits pointing out exactly 
what facts are established and relied on by applicant." It is respectfully submitted that the 
Applicants followed this requirement by pointing out the following facts that are established 
and relied on in the declaration: 

4. We participated on a team that developed the implementation of claims 1 
- 5 and 21-25 that is incorporated into an Oracle™ database server product. 
After the design phase of the development, successful tests were run to show 
that the implementation worked according to claims 1-5 and 21 - 25. These 
tests , which were conducted using standard internal test processes and 
procedures, were completed before the effective filing date of Ayi and were 
carried out in this country. 

5. Attached as Exhibit A is a true and correct print out of substantially all of 
test script file 'tzlasOl.sql'. The test script was used to test the implementation . 

6. Attached as Exhibit B is a true and correct printout of test script log file 
'tzllas01.log', which shows the results of running the test script shown in Exhibit 
A before the effective filing date of Ayi. The results show that the tests were 
successful. 

7. Attached as Exhibit C is a true and correct print out of substantially all of 
test script file 'tzlbacl4.sql'. The test script was used to test the implementation . 

8. Attached as Exhibit D is a true and correct printout of test script log file 
'tzlbacl4.log', which shows the results of running the test script shown in Exhibit 
C before the effective filing date of Ayi. The results show that the tests were 
successful. 
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9. Exhibit D has been annotated with bolded and bracketed comments that 
illustrate how Exhibit D supports the claim language of Claims 1-5 and 21-25, 
as required by the Examiner in the Office Action dated March 3, 2006. 

10. Exhibits A, B, C, and D are submitted as probative of the fact that the 
successful tests referred to in paragraph 4 were executed before the filing date of 
Ayi . (emphasis added) 

4. In response to Appellants assertion that "MPEP § 2138.05 pertains to 
interference practice and 37 CFR 1.131 does not apply in interference proceedings (see 
MPEP 2138.01(111))," the Examiner's Answer cites (on page 17) the following portion of 
MPEP § 2138: "35 U.S.C. 102(g) issues such as conception, reduction to practice and 
diligence, while more commonly applied to interference matters, also arise in other contexts " 
(emphasis in Examiner's Answer). This MPEP statement merely indicates that reduction to 
practice arises in contexts other than interference matters. However, this statement is far from 
requiring that the requirements under MPEP § 2138.05 apply to 37 CFR § 1.131 declarations. 

Nevertheless, the Examiner has not indicated which of the three tests for actual 
reductions to practice the inventors have not fulfilled. Apparently, Office policy states: 

a. Testing is required unless operativeness of invention is readily apparent. 

b. Testing, if required, must be under actual working conditions or realistic 
simulation of working conditions. 

c. Test results must be repeatable. 

It is respectively noted that Appellants have fulfilled all three tests. The inventors stated in the 
declaration that "successful tests were run to show that the implementation worked 

according to claims 1-5 and 21 - 25" (f 4; emphasis added). Furthermore, software tests are 
clearly repeatable. 

5. There is a sound policy reason why a strict correlation between exhibits and each 
claim limitation is not required by the CFR and the MPEP. Many inventions (e.g., database- 
related inventions) are low level in nature. Thus, no user manual would ever describe the 
details of such inventions. Indeed, many inventions are "transparent" (or undetectable) to end- 
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users. Additionally, many design and functional specifications do not describe such inventions 
at the level in which the inventions are claimed. Therefore, a requirement for the sought-after 
correlation between exhibits and specific claim limitations would effectively eliminate the 
right of many applicants to antedate cited references. 

6. With respect to Claims 6 and 26, the Examiner's Answer cites (on page 18) 
paragraphs 6, 8, and 64 of Ayi for allegedly disclosing "associating a first policy of a first model 
set in a first package with a first table within the database system" as recited in Claims 6 and 
26. The Examiner's Answer explicitly quotes the following portion of Ayi for this allegation: 
"defining a set of rules that establish a policy, and generating one or more labels based on the 
defined policy for marking, e.g., tagging, the dataset." However, this quoted portion merely 
teaches defining rules and generating labels. Claims 6 and 26, on the other hand, require (1) 
registering a package with a database management system and (2) that after a policy of that 
package is associated with a table, an access mediation routine of that same package is 
invoked to determine whether an operation is allowed on data of that table. The cited 
portions of Ayi (as well as Hayman) fail to teach or suggest registering such a package with a 
database management system. 

7. The Examiner's Answer again alleges (on page 18) that col. 9, line 55 to col. 10, 

line 4 of Hayman teaches "invoking the access mediation routine in the first package for 

determining whether to allow operation on data in the first table based on the first policy" as 

recited in Claims 6 and 26. The Examiner's Answer fails to address Appellants' argument in 

the Appeal Brief that: 

the reference does not disclose that a Reference Monitor may be registered so 
that it can be customized and implemented by the user. Indeed, the Reference 
Monitor was described in a version of Data General's security system as being 
"tightly integrated with Data General's operating system" (col. 1, lines 26-28). 
This indicates that customization is not readily possible and that the Reference 
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Monitor is actually an embedded native software component of the security 
system, not a separate package that can be registered . Again, this is all in 
contradiction to the elements of Claims 6 and 26. (emphasis in original) 

8. In response to Appellant's argument that "Hayman fails to teach or suggest that 
a policy module and policy data (1) originate from the same package (2) that is registered with 
a database management system," the Examiner's Answer merely re-quotes (i.e., without 
traversing this argument) (on page 20) col. 9, lines 61-65 and col. 8, line 67 to col. 9, line 13 of 
Hayman, the latter of which describes the Session Monitor. However, as discussed in the 
Appeal Brief, the Session Monitor "controls the manner in which a user or administrator 
initially gains access to the system , and the manner in which a user or administrator changes 
from their current mode of access to a different mode (for example, from user to 
administrator)" (col. 8, lines 55-60; emphasis added). In contrast, Claims 6 and 26 require that 
a policy of a package is associated with a table within the database system. There is no 
teaching or suggestion in Hayman that the Session Monitor, or any component thereof, is 
associated with a table or other data objects within a database system. Therefore, the 
Session Monitor cannot be equated to any portion of the recited package. 

9. It is true, as indicated in the Examiner's Answer on pages 20-21), that "label is 
registered with a database management system" is not recited in the claims. However, 
Appellants were not asserting such. Instead, Appellants were explaining that the logical result 
of the Examiner equating the "labels" described in col. 5, lines 18-60 of Hayman with the 
recited "first policy" of Claim 6 is that Hayman' s "label" would have to be of a package that is 
registered with a database management system because the recited "first policy" of Claims 6 
and 26 is a policy of a package that is registered with a database management system. 
However, Hayman 's label is not of a package that is registered with a database management 
system. 
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10. With respect to Claim 8, the Examiner's Answer merely quotes (on pages 21-22) 
col. 1, line 54 to col. 2, line 8 of Hayman for allegedly disclosing "said step of forming said 
each package further comprising including one or more administrative routines for defining a 
policy for the model set" as recited in Claim 8. It is unclear what in this quoted portion of 
Hayman could be equated to the recited "administrative routines." 

The Examiner's Answer also quotes col. 4, lines 5-13 of Hayman for allegedly 

disclosing Claim 8. This is incorrect. That quoted portion states: 

allow the security policy enforced by the system to be configurable by each site 
to meet its individual requirements, privilege checks are done by means of 
"events". An event is defined as "a place in the code where a security-relevant 
decision is made or recorded". When the system needs to check whether a 
process should be allowed to perform some operation, it uses the unique event 
name defined for that particular privilege check to look up, in a table, the 
capability or capabilities which the process must possess to pass the check. By 
providing a mechanism for individual sites to modify the event name-to- 
capability table, the site can configure the system to enforce their own security 
policy, in addition to, or instead of, the supplied event/capability policy 
delivered with the security system, (emphasis added) 

Perhaps the Examiner's Answer equates this "mechanism" of Hayman with the recited 

administrative routines for defining a policy. However, Hayman fails to teach or suggest that 

that "mechanism" is included in a package (1) that is registered with a database management 

system and (b) that also includes the recited access mediation routine , as Claim 8 would 

require. 

1 1 . With respect to Claims 10 and 30, the Examiner' s Answer quotes (on page 23) 
col. 5, lines 20-26 and col. 1, line 63 to col. 2, line 4 of Hayman for allegedly disclosing "the 
step of invoking an administrative routine of the first package for defining the first policy" as 
recited in Claims 10 and 30. This is incorrect. The first quoted portion mentions that a security 
system allows checks, to be placed on a process, concerning which operations the process can 
perform. The second quoted portion mentions that strict policies are enforced by the security 
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system based on security labels. Again, however, these portions of Hayman fail to teach or 
suggest that an administrative routine is of a package (1) that is registered with a database 
management system and (b) that includes the recited access mediation routine , as Claims 10 
and 30 require. 

12. On page 24, the Examiner's Answer states that the recited "first package" of the 
claims is interpreted as any software routine or module. However, it is respectfully noted that 
"first package" is not recited in a vacuum. Claim 6 specifically recites that the one or more 
packages of routines are registered with a database management system. It is respectfully 
noted that not any software routine or module is " registerable" with a database management 
system . In fact, as repeatedly stated throughout this and previous responses. Hayman fails to 
teach or suggest a package of routines: (1) that is registered with a database management 
system; (2) that implements a security model ; and (3) includes an access mediation routine , 
which is invoked to determine whether to allow an operation of data to be performed. 

13. With respect to Claim 1 1, the Examiner's Answer states (on page 24), 
"Examiner has addressed this argument in response to arguments b) claims 10 and 30 and claim 
8. However, Claim 8 doesn't include the following language from Claim 11: "further 
comprising providing to the administrative routine of the first package a plurality of parameters 
including a policy name for the first policy and a plurality of label names for labels of the first 
policy"; nor does the Examiner's Answer address Appellants' arguments that pertain to this 
language of Claim 1 1 . 

14. With respect to Claims 20 and 40, the Examiner's Answer merely quotes (on 
pages 26-27) col. 8, line 55 to col. 9, line 26 of Hayman for allegedly disclosing "further 
comprising the step of storing the set of allowed labels in a session cache for a communication 
session between the database management system and the user" as recited in Claims 20 and 40. 
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This is incorrect. The quoted portion of Hayman refers to the "Session Monitor" discussed 
previously. However, as mentioned in the Appeal Brief, both Hayman and Ayi lack any 
mention of the term cache or anything equivalent. Therefore, Hayman and Ayi, both 
individually and in combination, fail to even suggest that the recited set of allowed labels are 
stored in a session cache for a communication session between the database management 
system and a user. The Examiner's Answer fails to address this argument. 

CONCLUSION 

Based on the foregoing, it is respectfully submitted that the rejection of Claims 1-40 
under 35 U.S.C. § 103(a) lacks the requisite factual and legal bases. Appellants therefore 
respectfully request that the Honorable Board reverse the rejection of Claims 1-40 under 35 
U.S.C. § 103(a). 

Respectfully submitted, 

HICKMAN PALERMO TRUONG & BECKER LLP 

/DanielDLedesma#57 181/ 

Daniel D. Ledesma 
Reg. No. 57,181 

Date: January 9, 2009 

2055 Gateway Place, Suite 550 
San Jose, CA 95110-1083 
Telephone: (408) 414-1080 ext. 229 
Facsimile: (408)414-1076 
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